Reverse Engineering PopUnder Trick for Chrome

[@LStranck]

You really hate the man who created that library

[@thefunnysmoke1526]

😂😂😂

[@wojciechwilimowski985]

Mutually

[@ezequielgarrido3987]

Listen man, your content is completely astounding, I've never been more excited over a video about ads. Keep it up!

[@daviidon]

I don't know if the guy selling the script is mad or amazed...

[@LiEnby]

singlehandedly destroying his business xD

[@Rhidayah]

Plot twist: He is guy who selling the popunder

[@biehdc]

that guy who sells this stuff starts getting even more mad now :D

[@Amilakasun1]

He'll soon device a plan to take over all of internet because of this.

[@RiktigMusik]

I SWEAR I was just about to comment exactly the same thing then I saw your comment :D he must hate him 😂

[@PyPylia]

It's 2020 and they still don't have a working popunder. We've won (for now).

[@madpivots]

@@PyPylia Just checked his website, he has a "working" one (not a real popunder) but rather it opens a new tab without you noticing

[@sanchayanghosh1240]

@@madpivots from what I see the focus does go to the new tab in latest chrome. His popunder script is just misleading at this point.

[@peterjohnson9438]

I'm in awe at both the tenacity and (perhaps) ingenuity of the popunder maker, but also of your ability to document your train of thought. Shame I can't subscribe more than once :D

[@user-cz9ss4yq4x]

Thank you so much for this. Not only are you providing quality content but you are making the Internet more secure and usable. I always feel like it's a privilege to the sites that they can use JS on *my systems*. So they should obey my rules, not the other way round. Browser exploits should be illegal, I clearly disallowed pop-ups/unders and these sites still hack my system with commercial intent.

[@user-cz9ss4yq4x]

Created German subtitles, please confirm @LiveOverflow :)

[@tommyeldiablo]

I absolutely love your videos , I must say I understand only 40-50% of what you say , but that gives me motivation to read about stuff that I have never heard before . Keep up the good work man :)

[@HACKINGWITHLINUX]

this popunder guy is just on next level

[@omaryahia]

we can't "under"estimate him 😁

[@123-e3h1y]

I think we all agree JavaScript shouldn't run through PDF documents. Seems like a gaping attack vector.

[@shary0]

It is. Most of malicious PDF files use JS. JS in PDF is enough of a problem to be the subject of multiple internships (including mine :D).

[@Daniel15au]

How is JS in PDF different to JS in HTML though? Assuming both are sandboxed.

[@robslaney3729]

Is it possible to restrict the use of base64 encoded PDFs ? Thinking of creating a extension that kills all these tags

[@Daniel15au]

If Base64 encoded PDFs were restricted, they'd just stop using Base64 encoding.

[@comradepeter87]

JS in PDFs allow access to local files I think. That could be very dangerous.

[@billdimz]

I don't understand 10% of this, but I am *AMAZED* with your programming skills.

[@TTTrouble]

If anyone sees this, the functionality of the extension he is talking about can be accomplished with the chrome extension “Resource Override” which lets you replace a websites JavaScript with local written scripts, inject it into the head or body and modify request/response headers as well. I went through a whole reverse engineering/scraping exercise and was able to troubleshoot a great deal with this functionality. I could copy the original pages JavaScript into a new JS file, replace it at the HTTP request level with and iteratively edit my copied JS file to investigate what the obfuscated functions did as well as which were necessary and which were trying to prevent reverse engineering and comment those out. Just thought I’d mention it in case someone stumbles across on this the way I did. Stay safe all!

[@fission1110]

I had the exact same idea, and have been working on the browser logging/strace/ltrace thing ever since your last video! I've run into tons of problems but have a halfway working prototype. I'll throw it up on github when I get something semi functional.

[@fission1110]

I've debated hooking into the profiler in c++ and releasing a malware analysis oriented fork of chromium. Javascript has so many quarky features and edge cases that it's difficult to handle everything with Proxy objects. Mostly been having trouble with Symbols and illegal invocation exceptions, and "read only" variables.

[@LiveOverflow]

Try to find solutions that don't require to fork the browser, or put a lot of time into a design that allows easy patching of new versions. DOMinator tried to do that with firefox to log DOM events and analyse them for DOM XSS, and afaik the project kinda withered away because maintaining something like this is a damn lot of work. What is your current approach? I would be interested to chat about this and hear your progress. Can you write me twitter DM or google hangouts or so?

[@fission1110]

Messaged you on hangouts

[@unutilized]

ok, the mouseup timing idea is amazing.

[@trieulieuf9]

Agreed, that is an amazing idea.

[@T3sl4]

"How To Open A Window In 0.5 'A' Presses" :D

[@liveportalfeedenglishchane5928]

An "A" press is an "A" press, you can't say it's a half.

[@4pxris3]

thats the joke...

[@liveportalfeedenglishchane5928]

You saying this about my comment?

[@liveportalfeedenglishchane5928]

@@fasdus Wait, Now I am confused, Am I being wooshed because of "An "A" press is an "A" press you can't say its a half" or the "you saying this about my comment" comment, because if it is the former... I have some bad news - 'tis a reference to a video by pannenkoek2012 (Watch for rolling rocks in 0.5 A presses fairly near the start) If it is the latter, then go get your karma :D.

[@NtQueryInformationProcess]

@@4pxris3 r/woooosh

[@MahNameIsJeff]

I bet the only dislike from this video is by the guy that sells the popunder services LMAO

[@funnyyylock]

David Saez some how 13 “humans” dislike this

[@laurinneff4304]

funnyyylock The library seller probably created 13 accounts

[@XArthieX]

Damm those are some very clever tricks!

[@GigaBoost]

The guy making these scripts must be so pissed

[@Coolfolder]

Does it break if you click extremely quickly or hold the mouse down for an extended period of time before releasing?

[@poryg5350]

A regular user won't care about holding a mouse button for long.

[@devikakrishna4464]

"The problem of being faster than light is that you can only live in darkness" - Google Chrome

[@corbintheintern6229]

I'm blown away. I've been programming for just over a year now and I don't think I'll ever be THIS good.

[@christobanistan8887]

Give it 10.

[@gabrielbarroso4118]

by the way, the anti debugger script won't work for smarter variations, like: function(){ eval('deb' + 'ugger'); } actually, setInterval itself can evaluate string code, so: setInterval('debugger',1); I don't think this would trigger the function constructor

[@eternialogic]

always glad that people like you are finding all of those popunders so that we are not giving free views and losing bandwidth to some 13 year old playing CS:GO.

[@mohamedabdelmonim8111]

I like your videos so much and they helped me a lot, Thank you,keep going! Can you have an episode for AFL fuzzer or fuzzing as general idea? that would be great as I couldn't find a good simple explanation.

[@Salmiery]

Great video yet again! Hopefully you are getting kickback from Google for bug bounties!

[@tristant9686]

This is super cool. Please keep making more content.

[@angelcaru]

The basic idea popunder

5:24 Nice German past tense suffix.

[@LiveOverflow]

oops

[@cesasol]

As a web developer I'm amazed, you take the time to explain everything

[@5aboody5]

Ur My New Fav Channel I always Learn More From U It Hapen To Me That I Thought That The POPup Have been Close And It Was In the Back Thx Teacher

[@seismicdna]

You could also make a userscript/tamper monkey script that will make this process faster (for prototyping)

[@yesthatsam]

Brilliant as usual .Thanks!

[@LF-ro7nk]

You are a Genius!

[@fadmad7257]

Hey man I just wanted to find out if you do any real world vulnerability research, and how much CTFs help with that, e.g finding sandbox escape bugs in chrome or linux kernel vulnerabilities? thanks for your videos.

[@jakub.boucek]

I love your stories! :-D

[@Daniel15au]

Fantastic video! Thank you for posting it.

[@nsg650]

first thing the popunder library need to do is disble the demo page which help liveoverflow to know how it works and report it as a bug to chromium bugs

[@soopyc]

Yay fixed in version 69 :) EDIT: the pop under is appeared in another tab and returned me to my original page

[@sunted5454]

thank you very much, you deserved a like

[@Sypaka]

This is the reason Javascript needs permissions. Oh, you want to window.open()? nope, it's denied. Adblocker and NoScript only take you so far.

[@bulbyvr]

Wait is that why a lot of websites ask for notifications?

[@Rudxain]

This reminds me of Death Note and other animes about hackers. This is the most epic battle lol

[@ndm13]

You should consider throwing the code into a deobfuscator first. It'd make debugging easier!

[@Rhidayah]

The founder pop under be like: Ah $hit here we go again

[@retrogameplus3838]

He's gonna piss of the advertising mafia they were totally saving a second exploit which they deployed.

[@abdoben833]

my brain is about to explode

[@MoraFermi]

Alternative title: When "Fast" is Too Fast.

[@WorldReserveCurrency]

great stuff!

[@ineedtodrive]

performance tab.damn. got u!

[@donovanvanderlinde3478]

Isn't this really problematic .... My js isn't shabby and i can think of some very bad consequences of this.... If you can write that event listener to the second tab via that window object what stops you from taking anything from the current scope and sharing it via the second page?

[@joachim4660]

Can I download a chrome extension you did?

[@DanielLiNeutrinos]

Pop under is real scummy. Thanks for helping deal with that!

[@toyotahiace4515]

What happens then when you hold down mousebutton?

[@christobanistan8887]

Surely the tab wouldn't close till you lifted.

[@PipleKlo]

This is fucking genius.

[@TheSpawacz]

9:22 hah toż to papieżowa liczba

[@oldpain7625]

If something like this exists as a job, what is it?

[@TheSpacecraftX]

Are they giving you bug bounties on these?

[@u_rnext2bvirus929]

Aren't they still collecting meta data from you , even if your leaving in the back ground?

[@vaibhavbhoir6995]

Why do they use popunders?

[@undefinedchannel9916]

to get ads in the background, maybe you'll be less likely to notice/close them or something?

[@crypto.7562]

It doesn't work anymore

[@scarlas7071]

Why is a script allowed to call document.write on another tab it just opened? Doesn't this make it possible to open any website and write a script to it to steal cookies like in XSS?

[@LiveOverflow]

Indeed. You can't do that with any page. But it opened a blank page so the same origin policy is not violated ;)

[@scarlas7071]

I don't think I fully understand. As I understand it, the same origin policy is means that a script is not allowed to send a get request to a different domain with cookies. When a new tab is opened, I do get an authenticated site, and the document.write function does not perform a get request. Is this a different aspect of the same origin policy that was not explained in web 0x04?

[@LiveOverflow]

there is no get request involved. we just open a blank page, no site is loaded on the new tab. And thus we can write to the document of it. If we had opened an actual website, we wouldn't be allowed to write to it.

[@scarlas7071]

I think I get it now. Writing to a page is apparently subject to the same restrictions as requesting resources. The about:blank page is not considered a website so the same origin policy does not apply to it. Thanks for clarifying.

[@john80944]

god this is amazing.

[@UsatiyNyan]

The L and the Kira DeathNotebook: Ads

[@segfault-berlin]

I use I3, good luck popping under there

[@daanbreur]

LifeOverflow - Reverse Engineering Popunders for Chrome to solve

[@zihasz5305]

There are obfusctators that rename everything to a combination if l and I so your lucky that this is not like that :)

[@山田ちゃん]

Are You working in a VM or do you Forget to install a Video driver? 😁😥

[@TechKerala]

Not working on Stable Chrome Mac :( didn't checked my chrome version. time to sleep.. good night.. Nice video ;) keep going.

[@LiveOverflow]

+TechKErala yeah because it affects only Windows ;)

[@TechKerala]

Oh,, i am sorry! I watched it again! you said it works only on windows! I missed that! :)

[@tomaschku]

0:46 "How?" Because Windows is crap in Security?

[@LiEnby]

but this is an issue with chrome not windows ^

[@t33th4n]

Perhaps you should start asking for money not to release videos... Let's say 100k for a week delay?! :D

[@ETXAlienRobot201]

extorting extortionists! nice! unfortunately, they could probably sue him or such for that... besides the fact disclosing this so it can be broken more permanently is the better thing to do here.

[@itsxxxiang3865]

I was new to push notifications couple of months ago... been doing research of best ad networks for push notifications. Tested couple of networks - eventually came across MonadPlug Push Monetization. I can saythat I regret not finding MonadPlug earlier, definitely check it out!

[@magicalframe9441]

This is the definition of white hat

[@oeb41]

cmon hes just trying to make a living

[@wojciechwilimowski985]

Clever girl...

[@TheMrMinePlaysHD]

oida du bist ein Gott

[@unclejoe8310]

Hey lieber LiveOverflow, ähnlich wie du hab ich mich immer für Reverse Engineering interessiert, konkreter: Malware Analysis Kannste mal sowas machen? Gruss

[@LiveOverflow]

+alder Goony schau dir malwareanalysishedgehog an ;)

[@paulhendrix8599]

Geil. Danke.

[@unclejoe8310]

Danke auch :) Paul auch interessiert :)

[@marygraceandong9326]

MonadPlug is an amazing ad-network for push monetization, just thought I should share it since my revenue increased by 20% after switching from another network.

[@raouflezoul2662]

..

[@valen8560]

it is a beautiful abuse of mechanisms

[@christobanistan8887]

:)) clever

[@thegodreo]

gi

[@inaccessible2720]

Nice

[@fatyeet6882]

didn't think I'd see you here

[@inaccessible2720]

wowowowow

[@Beaches_south_of_L.A.]

Dude you never get to the point plus you have endless tangents. I can't take anymore

[@ricardo.mazeto]

That's one of the reasons I use terminal based browsers for most of my browsing.

[@willrebain]

"I ride a scooter because automobiles can be involved in traffic incidence" Your logic. Flawless.

[@ricardo.mazeto]

Your counter argument makes little sense, since scooters are more vulnerable to accidents than cars.

[@moth.monster]

How's it like to watch a youtube video through a terminal?

[@ricardo.mazeto]

Copy the link (tmux supports copy and paste), and run "mpv --vo drm ytdl://kzbin.info/www/bejne/hoHdg5aQgbN2hrs".

[@lunafoxfire]

Lol... whatever floats your boat I guess